metasploit | 7cc977780d1eb0233a5455d1b776b3fc480338ee11c6dee8f27c3861e114db92

Analysis

max time kernel
126s
max time network
131s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
30-04-2024 18:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bitch.exe
Size

72KB
MD5

a13e7aec1427a7d7754f88bc497db13a
SHA1

17b237e46fe8f07531e3a9bb99360dbf8fae875d
SHA256

7cc977780d1eb0233a5455d1b776b3fc480338ee11c6dee8f27c3861e114db92
SHA512

c428d863afaee62879662ea95cfa20dba0b82f24079d380e0d0cd5d613631933f975e1d0c350e4c0dde90b85db8454d157ef130d8aa16385cd6f030217fa51ea
SSDEEP

1536:IY7cR/axzO+K98WLEZu6t3jcIKGTZWGMb+KR0Nc8QsJq39:JQR/afK9pOuCjLxe0Nc8QsC9

Score

10^/10

metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

windows/reverse_tcp

192.168.23.205:4444

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133589737130484729"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

chrome.exe

pid process

5020 chrome.exe
5020 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

chrome.exe

pid process

5020 chrome.exe
5020 chrome.exe
5020 chrome.exe
5020 chrome.exe
5020 chrome.exe
5020 chrome.exe

Suspicious use of AdjustPrivilegeToken 58 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	5020	chrome.exe
Token: SeCreatePagefilePrivilege	5020	chrome.exe
Token: SeShutdownPrivilege	5020	chrome.exe
Token: SeCreatePagefilePrivilege	5020	chrome.exe
Token: SeShutdownPrivilege	5020	chrome.exe
Token: SeCreatePagefilePrivilege	5020	chrome.exe
Token: SeShutdownPrivilege	5020	chrome.exe
Token: SeCreatePagefilePrivilege	5020	chrome.exe
Token: SeShutdownPrivilege	5020	chrome.exe
Token: SeCreatePagefilePrivilege	5020	chrome.exe
Token: SeShutdownPrivilege	5020	chrome.exe
Token: SeCreatePagefilePrivilege	5020	chrome.exe
Token: SeShutdownPrivilege	5020	chrome.exe
Token: SeCreatePagefilePrivilege	5020	chrome.exe
Token: SeShutdownPrivilege	5020	chrome.exe
Token: SeCreatePagefilePrivilege	5020	chrome.exe
Token: SeShutdownPrivilege	5020	chrome.exe
Token: SeCreatePagefilePrivilege	5020	chrome.exe
Token: SeShutdownPrivilege	5020	chrome.exe
Token: SeCreatePagefilePrivilege	5020	chrome.exe
Token: SeShutdownPrivilege	5020	chrome.exe
Token: SeCreatePagefilePrivilege	5020	chrome.exe
Token: SeShutdownPrivilege	5020	chrome.exe
Token: SeCreatePagefilePrivilege	5020	chrome.exe
Token: SeShutdownPrivilege	5020	chrome.exe
Token: SeCreatePagefilePrivilege	5020	chrome.exe
Token: SeShutdownPrivilege	5020	chrome.exe
Token: SeCreatePagefilePrivilege	5020	chrome.exe
Token: SeShutdownPrivilege	5020	chrome.exe
Token: SeCreatePagefilePrivilege	5020	chrome.exe
Token: SeShutdownPrivilege	5020	chrome.exe
Token: SeCreatePagefilePrivilege	5020	chrome.exe
Token: SeShutdownPrivilege	5020	chrome.exe
Token: SeCreatePagefilePrivilege	5020	chrome.exe
Token: SeShutdownPrivilege	5020	chrome.exe
Token: SeCreatePagefilePrivilege	5020	chrome.exe
Token: SeShutdownPrivilege	5020	chrome.exe
Token: SeCreatePagefilePrivilege	5020	chrome.exe
Token: SeShutdownPrivilege	5020	chrome.exe
Token: SeCreatePagefilePrivilege	5020	chrome.exe
Token: SeShutdownPrivilege	5020	chrome.exe
Token: SeCreatePagefilePrivilege	5020	chrome.exe
Token: SeShutdownPrivilege	5020	chrome.exe
Token: SeCreatePagefilePrivilege	5020	chrome.exe
Token: SeShutdownPrivilege	5020	chrome.exe
Token: SeCreatePagefilePrivilege	5020	chrome.exe
Token: SeShutdownPrivilege	5020	chrome.exe
Token: SeCreatePagefilePrivilege	5020	chrome.exe
Token: SeShutdownPrivilege	5020	chrome.exe
Token: SeCreatePagefilePrivilege	5020	chrome.exe
Token: SeShutdownPrivilege	5020	chrome.exe
Token: SeCreatePagefilePrivilege	5020	chrome.exe
Token: SeShutdownPrivilege	5020	chrome.exe
Token: SeCreatePagefilePrivilege	5020	chrome.exe
Token: SeShutdownPrivilege	5020	chrome.exe
Token: SeCreatePagefilePrivilege	5020	chrome.exe
Token: SeShutdownPrivilege	5020	chrome.exe
Token: SeCreatePagefilePrivilege	5020	chrome.exe

Suspicious use of FindShellTrayWindow 27 IoCs

Processes:

chrome.exe

pid	process
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

chrome.exe

pid	process
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 5020 wrote to memory of 5024	5020	chrome.exe	chrome.exe
PID 5020 wrote to memory of 5024	5020	chrome.exe	chrome.exe
PID 5020 wrote to memory of 4888	5020	chrome.exe	chrome.exe
PID 5020 wrote to memory of 4888	5020	chrome.exe	chrome.exe
PID 5020 wrote to memory of 4888	5020	chrome.exe	chrome.exe
PID 5020 wrote to memory of 4888	5020	chrome.exe	chrome.exe
PID 5020 wrote to memory of 4888	5020	chrome.exe	chrome.exe
PID 5020 wrote to memory of 4888	5020	chrome.exe	chrome.exe
PID 5020 wrote to memory of 4888	5020	chrome.exe	chrome.exe
PID 5020 wrote to memory of 4888	5020	chrome.exe	chrome.exe
PID 5020 wrote to memory of 4888	5020	chrome.exe	chrome.exe
PID 5020 wrote to memory of 4888	5020	chrome.exe	chrome.exe
PID 5020 wrote to memory of 4888	5020	chrome.exe	chrome.exe
PID 5020 wrote to memory of 4888	5020	chrome.exe	chrome.exe
PID 5020 wrote to memory of 4888	5020	chrome.exe	chrome.exe
PID 5020 wrote to memory of 4888	5020	chrome.exe	chrome.exe
PID 5020 wrote to memory of 4888	5020	chrome.exe	chrome.exe
PID 5020 wrote to memory of 4888	5020	chrome.exe	chrome.exe
PID 5020 wrote to memory of 4888	5020	chrome.exe	chrome.exe
PID 5020 wrote to memory of 4888	5020	chrome.exe	chrome.exe
PID 5020 wrote to memory of 4888	5020	chrome.exe	chrome.exe
PID 5020 wrote to memory of 4888	5020	chrome.exe	chrome.exe
PID 5020 wrote to memory of 4888	5020	chrome.exe	chrome.exe
PID 5020 wrote to memory of 4888	5020	chrome.exe	chrome.exe
PID 5020 wrote to memory of 4888	5020	chrome.exe	chrome.exe
PID 5020 wrote to memory of 4888	5020	chrome.exe	chrome.exe
PID 5020 wrote to memory of 4888	5020	chrome.exe	chrome.exe
PID 5020 wrote to memory of 4888	5020	chrome.exe	chrome.exe
PID 5020 wrote to memory of 4888	5020	chrome.exe	chrome.exe
PID 5020 wrote to memory of 4888	5020	chrome.exe	chrome.exe
PID 5020 wrote to memory of 4888	5020	chrome.exe	chrome.exe
PID 5020 wrote to memory of 4888	5020	chrome.exe	chrome.exe
PID 5020 wrote to memory of 4888	5020	chrome.exe	chrome.exe
PID 5020 wrote to memory of 2344	5020	chrome.exe	chrome.exe
PID 5020 wrote to memory of 2344	5020	chrome.exe	chrome.exe
PID 5020 wrote to memory of 1748	5020	chrome.exe	chrome.exe
PID 5020 wrote to memory of 1748	5020	chrome.exe	chrome.exe
PID 5020 wrote to memory of 1748	5020	chrome.exe	chrome.exe
PID 5020 wrote to memory of 1748	5020	chrome.exe	chrome.exe
PID 5020 wrote to memory of 1748	5020	chrome.exe	chrome.exe
PID 5020 wrote to memory of 1748	5020	chrome.exe	chrome.exe
PID 5020 wrote to memory of 1748	5020	chrome.exe	chrome.exe
PID 5020 wrote to memory of 1748	5020	chrome.exe	chrome.exe
PID 5020 wrote to memory of 1748	5020	chrome.exe	chrome.exe
PID 5020 wrote to memory of 1748	5020	chrome.exe	chrome.exe
PID 5020 wrote to memory of 1748	5020	chrome.exe	chrome.exe
PID 5020 wrote to memory of 1748	5020	chrome.exe	chrome.exe
PID 5020 wrote to memory of 1748	5020	chrome.exe	chrome.exe
PID 5020 wrote to memory of 1748	5020	chrome.exe	chrome.exe
PID 5020 wrote to memory of 1748	5020	chrome.exe	chrome.exe
PID 5020 wrote to memory of 1748	5020	chrome.exe	chrome.exe
PID 5020 wrote to memory of 1748	5020	chrome.exe	chrome.exe
PID 5020 wrote to memory of 1748	5020	chrome.exe	chrome.exe
PID 5020 wrote to memory of 1748	5020	chrome.exe	chrome.exe
PID 5020 wrote to memory of 1748	5020	chrome.exe	chrome.exe
PID 5020 wrote to memory of 1748	5020	chrome.exe	chrome.exe
PID 5020 wrote to memory of 1748	5020	chrome.exe	chrome.exe
PID 5020 wrote to memory of 1748	5020	chrome.exe	chrome.exe
PID 5020 wrote to memory of 1748	5020	chrome.exe	chrome.exe
PID 5020 wrote to memory of 1748	5020	chrome.exe	chrome.exe
PID 5020 wrote to memory of 1748	5020	chrome.exe	chrome.exe
PID 5020 wrote to memory of 1748	5020	chrome.exe	chrome.exe
PID 5020 wrote to memory of 1748	5020	chrome.exe	chrome.exe
PID 5020 wrote to memory of 1748	5020	chrome.exe	chrome.exe

C:\Users\Admin\AppData\Local\Temp\bitch.exe
"C:\Users\Admin\AppData\Local\Temp\bitch.exe"
1⤵
PID:3724

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5020

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffda980ab58,0x7ffda980ab68,0x7ffda980ab78
2⤵
PID:5024

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1644 --field-trial-handle=1788,i,15420904437667492683,2468664999888236476,131072 /prefetch:2
2⤵
PID:4888

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1788,i,15420904437667492683,2468664999888236476,131072 /prefetch:8
2⤵
PID:2344

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2184 --field-trial-handle=1788,i,15420904437667492683,2468664999888236476,131072 /prefetch:8
2⤵
PID:1748

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3044 --field-trial-handle=1788,i,15420904437667492683,2468664999888236476,131072 /prefetch:1
2⤵
PID:2692

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3188 --field-trial-handle=1788,i,15420904437667492683,2468664999888236476,131072 /prefetch:1
2⤵
PID:3512

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4188 --field-trial-handle=1788,i,15420904437667492683,2468664999888236476,131072 /prefetch:1
2⤵
PID:3384

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3804 --field-trial-handle=1788,i,15420904437667492683,2468664999888236476,131072 /prefetch:8
2⤵
PID:1844

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4524 --field-trial-handle=1788,i,15420904437667492683,2468664999888236476,131072 /prefetch:8
2⤵
PID:1688

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4568 --field-trial-handle=1788,i,15420904437667492683,2468664999888236476,131072 /prefetch:8
2⤵
PID:2736

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4704 --field-trial-handle=1788,i,15420904437667492683,2468664999888236476,131072 /prefetch:8
2⤵
PID:4880

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4884 --field-trial-handle=1788,i,15420904437667492683,2468664999888236476,131072 /prefetch:8
2⤵
PID:4020

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4784 --field-trial-handle=1788,i,15420904437667492683,2468664999888236476,131072 /prefetch:1
2⤵
PID:4608

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4220 --field-trial-handle=1788,i,15420904437667492683,2468664999888236476,131072 /prefetch:1
2⤵
PID:4924

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3328 --field-trial-handle=1788,i,15420904437667492683,2468664999888236476,131072 /prefetch:1
2⤵
PID:1588

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:2016

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
356B

MD5
3f1ec974cdccfcbb0cba01845aebc08c

SHA1
05d0b09156335d79ad323c326742918bc9f965d8

SHA256
32b20f0d9cc7c4821ff3c8d6261af10fff423e9db91f3536e0bed7edd9a1099e

SHA512
222536b9b17e528ad00e819e99d2774650c04a22fbd81abc7d9a8f2db2c046317fc3dbdae0f25699aa5ac4ecbb7dc2ea5b9537ec6071e41955068c367702d6df

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\a2bdd6b8-a74a-440a-a001-30c93b9be52a.tmp
Filesize
1KB

MD5
be6e6d3b51cf6fb85daee172f6b72290

SHA1
3d7be0500a73904a70f619670a5a01d24d36a3b2

SHA256
8c039ce3b067666847f8bbda5dff9b72f9a73a16884a493e39fe747c4358704b

SHA512
c8465aee7bb203ec74b29cb0279260da531ca3f61d4bf2e86b9dc1615a919c7dba05d56c5edf971879053166116fd71e1a1376829944471091aaa285874acaee

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
5b3917db2b4590a6b9899e1ec3d0f46d

SHA1
6a42eaf70213068e65e0aa187a2e61a3bf1bfd9d

SHA256
789e8c92fb1f59295b7285e966a5c5697727532f40f0bf86cceb0dcb24c5c3f2

SHA512
44c282d159c405ca64fd154697a490621014a883430648d5857256e2e5852702bf4b79c94b70b860c179b4402aa2affe9eedcf78dd0444fe6d20606a178e0193

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Filesize
16KB

MD5
9633c71b0255f89d398367dc710eaaca

SHA1
f0bedd310659cbf8cd3b1508f4e297df39ee490c

SHA256
ecdd2c4a380717cd497bdb0c339a4e01a3812d09cc4ee7cce0afb044cd8f8348

SHA512
24be4cbb24427f6a874a1286e0766de1432d68af268f3d55de6ab8df06cdf18c7cbc641a49cf558f81e30d1fb38842fcdf2d1dbef58cc524333b367cf1fb3ec7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
256KB

MD5
c64ff663f410d332d2f6cb105b3d0ecc

SHA1
22abf17dce75c1853168c8cbeed2cc2201d98a16

SHA256
089bb42c00c03850fd76f4c99ae8d674c1bbff1982f7b71fb812eeb540c96338

SHA512
a780e662b6d868cadd6ae69bb1944acf8115e3197cc67f607dae7d5435ee25381c3e2d1905d996d0ca8d03be9d802f80a095bcc86fcc392272b02721f72e38d8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
256KB

MD5
5cf188d454861974eefb8c796df0efe1

SHA1
2727a9d21bf844b1e6b13a5179927747de41d857

SHA256
39db6c757f40fdf772387dee9c48a354d2c70368237f75efd85dbd4d591750f6

SHA512
98b6b72145807477abc5c0461666f234d0d760eda374fb7bdd3c8d24ecd5e27e2f6e4ac9414ab0f8d6bddf0f266b14ebb86c355bbeeddafda18993b4be089f6e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
\??\pipe\crashpad_5020_NWYJGBXJKXCQFSYC
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/3724-0-0x00000000005E0000-0x00000000005E1000-memory.dmp

Filesize
4KB

Download